CVE-2026-104135 | BDVDB-2026-400663 Detail

Description#

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-05Record published in the CVE List.